CVE-2025-38499
published 2025-08-11CVE-2025-38499: In the Linux kernel, the following vulnerability has been resolved: clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns What we…
medium5.5CVSS 3.1
AVLACLPRLUINSUCNINAH
In the Linux kernel, the following vulnerability has been resolved:
clone_private_mnt(): make sure that caller has CAP_SYS_ADMIN in the right userns
What we want is to verify there is that clone won't expose something
hidden by a mount we wouldn't be able to undo. "Wouldn't be able to undo"
may be a result of MNT_LOCKED on a child, but it may also come from
lacking admin rights in the userns of the namespace mount belongs to.
clone_private_mnt() checks the former, but not the latter.
There's a number of rather confusing CAP_SYS_ADMIN checks in various
userns during the mount, especially with the new mount API; they serve
different purposes and in case of clone_private_mnt() they usually,
but not always end up covering the missing check mentioned above.
Affected
54 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| debian | debian_linux | — | — |
| debian | linux | < linux 6.1.147-1 (bookworm) | linux 6.1.147-1 (bookworm) |
| debian | linux-6.1 | < linux 6.1.147-1 (bookworm) | linux 6.1.147-1 (bookworm) |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | — | — |
| linux | linux | >= 4.14.244 < 4.15 | 4.15 |
| linux | linux | >= 4.19.204 < 4.20 | 4.20 |
| linux | linux | >= 4.4.281 < 4.5 | 4.5 |
| linux | linux | >= 4.9.280 < 4.10 | 4.10 |
| linux | linux | >= 427215d85e8d1476da1a86b8d67aceb485eb3631 < 36fecd740de2d542d2091d65d36554ee2bcf9c65 | 36fecd740de2d542d2091d65d36554ee2bcf9c65 |
| linux | linux | >= 427215d85e8d1476da1a86b8d67aceb485eb3631 < d717325b5ecf2a40daca85c61923e17f32306179 | d717325b5ecf2a40daca85c61923e17f32306179 |
| linux | linux | >= 427215d85e8d1476da1a86b8d67aceb485eb3631 < dc6a664089f10eab0fb36b6e4f705022210191d2 | dc6a664089f10eab0fb36b6e4f705022210191d2 |
| linux | linux | >= 427215d85e8d1476da1a86b8d67aceb485eb3631 < e77078e52fbf018ab986efb3c79065ab35025607 | e77078e52fbf018ab986efb3c79065ab35025607 |
| linux | linux | >= 427215d85e8d1476da1a86b8d67aceb485eb3631 < 38628ae06e2a37770cd794802a3f1310cf9846e3 | 38628ae06e2a37770cd794802a3f1310cf9846e3 |
| linux | linux | >= 427215d85e8d1476da1a86b8d67aceb485eb3631 < c28f922c9dcee0e4876a2c095939d77fe7e15116 | c28f922c9dcee0e4876a2c095939d77fe7e15116 |
| linux | linux | >= 5.10.59 < 5.11 | 5.11 |
| linux | linux | >= 5.13.11 < 5.14 | 5.14 |
| linux | linux | >= 5.4.141 < 5.5 | 5.5 |
| linux | linux_kernel | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H
osv5.5MEDIUM